Every CVE Search/ Get API key

CVE-2021-38294

Shell Command Injection Vulnerability in Nimbus Thrift Server

9.8 CriticalPublic exploitFix available

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

83.8%Up 82.4 points since Oct 26, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

Record
CVE-2021-38294
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-74, CWE-78
Updated
2026-11-02
CVE List No score

Shell Command Injection Vulnerability in Nimbus Thrift Server

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

Record
CVE-2021-38294
Weakness
CWE-74
Updated
2026-11-02
EUVDEUVD-2021-2167 No score

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

Record
EUVD-2021-2167
Updated
2026-11-03
GitHub AdvisoriesGHSA-6768-mcjc-8223 9.8

Command injection leading to Remote Code Execution in Apache Storm

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

Record
GHSA-6768-mcjc-8223
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-74, CWE-78
Updated
2026-11-02
OSV 9.8

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

Record
CVE-2021-38294
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-6768-mcjc-8223 9.8

Command injection leading to Remote Code Execution in Apache Storm

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

Record
GHSA-6768-mcjc-8223
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-74, CWE-78
Updated
2026-11-02
OSVOESA-2021-1415 9.8

storm security update

Apache Storm realtime computation system

Security Fix(es):

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4.(CVE-2021-40865) A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.(CVE-2021-38294)

Record
OESA-2021-1415
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.storm:storm
Maven
 2.2.0 up to 2.2.1
2.2.1
org.apache.storm:storm
Maven
 2.0.0 up to 2.1.1
2.1.1
org.apache.storm:storm
Maven
 1.0.0 up to 1.2.4
1.2.4
org.apache.storm:storm
Maven
 2.0.0 up to 2.1.1, plus listed versions
2.1.0
2.1.1
org.apache.storm:storm
Maven
 1.0.0 up to 1.2.4, plus listed versions
1.0.11.0.21.0.31.0.41.0.5
Show 9 moreShow less
1.0.61.1.01.1.11.1.21.1.31.2.01.2.11.2.21.2.3
1.2.4
storm
openEuler:20.03-LTS-SP1
From an advisory covering 2 CVEs
 before 1.2.4-1.oe1
1.2.4-1.oe1
storm
openEuler:20.03-LTS-SP2
From an advisory covering 2 CVEs
 before 1.2.4-1.oe1
1.2.4-1.oe1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitApache Storm Nimbus getTopologyHistory Unauthenticated Command Execution2021-10-25

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-38294 is a critical vulnerability (CVSS 9.8) in Apache Storm, published October 25, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 83.8%, the 99th percentile. Fixed in org.apache.storm:storm 2.2.1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open